Adobe Patches 16 Substance 3D Stager Flaws, Including 14 Code Execution Vulnerabilities

Adobe released Substance 3D Stager 3.1.9 to address 16 vulnerabilities affecting version 3.1.8 and earlier on Windows and macOS. Security bulletin APSB26-170, published October 13, details 14 high-severity vulnerabilities that could allow arbitrary code execution and two medium-severity flaws that could expose memory or cause application denial-of-service.

All listed vulnerabilities require user interaction, according to their CVSS vectors, and Adobe reported no known exploitation in the wild. Adobe assigned the update a priority rating of 3 and recommends installing version 3.1.9 through the Creative Cloud desktop app. Organizations using Stager should identify affected installations and deploy the update across Windows and macOS endpoints.